Remote Monitoring and Management (RMM) tools make IT teams’ lives easier as they manage endpoints through screen sharing, file transfer, remote command execution, and patch deployment. Attackers also appreciate this convenience once they get a foothold in an environment. Rather than relying on custom malware, adversaries are blending in to look like routine IT workflows, logging in through the same tools IT teams already trust.

This report draws on analysis from almost 5 million endpoints protected by Huntress to break down why RMM abuse is a growing gap in most environments, how threat actors are using this tactic, and what you can do to close the gap.